后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

internal/apps/openflare/pages/helpers.go

@@ -80,18 +80,11 @@ func resolvePagesLimits(ctx context.Context) pagesLimits {
 
 	historyCount := defaultPagesMaxHistoryCount
 	if value, err := repository.GetIntByKey(ctx, model.ConfigKeyPagesMaxHistoryCount); err == nil {
-		if value < 0 {
-			historyCount = 0
-		} else {
-			historyCount = value
-		}
+		historyCount = max(value, 0)
 	}
 
 	packageBytes := int64(packageMB) * bytesPerMiB
-	extractedBytes := packageBytes * pagesExtractedSizeMultiplier
-	if extractedBytes < pagesMinExtractedSizeBytes {
-		extractedBytes = pagesMinExtractedSizeBytes
-	}
+	extractedBytes := max(packageBytes*pagesExtractedSizeMultiplier, pagesMinExtractedSizeBytes)
 
 	return pagesLimits{
 		PackageBytes:   packageBytes,
@@ -154,7 +147,7 @@ func normalizePagesFallbackPath(raw string) (string, error) {
 			return "", errors.New("spa fallback 回退路径不能包含空白或控制字符")
 		}
 	}
-	for _, segment := range strings.Split(value, "/") {
+	for segment := range strings.SplitSeq(value, "/") {
 		if segment == "." || segment == ".." {
 			return "", errors.New("spa fallback 回退路径不能包含 . 或 .. 路径段")
 		}
@@ -233,6 +226,8 @@ func safeTempSuffix(format pagesarchive.Format) string {
 		return "7z"
 	case pagesarchive.FormatTar:
 		return "tar"
+	case pagesarchive.FormatZip:
+		return "zip"
 	default:
 		return "zip"
 	}

internal/apps/openflare/pages/logics.go

@@ -513,7 +513,7 @@ func pruneProjectDeploymentHistory(ctx context.Context, projectID uint, keepCoun
 	// Two passes: first pass after upload, second pass heals a concurrent race
 	// that inserted another deployment between our list and delete.
 	var lastErr error
-	for pass := 0; pass < 2; pass++ {
+	for range 2 {
 		deleted, err := pruneProjectDeploymentHistoryOnce(ctx, projectID, keepCount, preserveCandidateID)
 		if err != nil {
 			lastErr = err

internal/apps/openflare/pages/rebind.go

@@ -6,6 +6,7 @@ package pages
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"path"
 	"strings"
@@ -89,11 +90,11 @@ func rebindPagesRouteMaps(ctx context.Context, routes []map[string]json.RawMessa
 		if route == nil {
 			continue
 		}
-		upstreamType, _ := rawJSONString(route["upstream_type"])
+		upstreamType := rawJSONString(route["upstream_type"])
 		if !strings.EqualFold(strings.TrimSpace(upstreamType), "pages") {
 			continue
 		}
-		siteName, _ := rawJSONString(route["site_name"])
+		siteName := rawJSONString(route["site_name"])
 		projectID, err := resolveProjectIDFromRouteMap(route)
 		if err != nil {
 			if siteName == "" {
@@ -151,7 +152,7 @@ func resolveProjectIDFromRouteMap(route map[string]json.RawMessage) (uint, error
 			return deployment.ProjectID, nil
 		}
 	}
-	return 0, fmt.Errorf("pages 配置无效: 缺少 pages_project_id")
+	return 0, errors.New("pages 配置无效: 缺少 pages_project_id")
 }
 
 func loadActivePagesProject(ctx context.Context, projectID uint, siteName string) (*model.PagesProject, *model.PagesDeployment, error) {
@@ -224,15 +225,15 @@ func buildLivePagesDeployment(
 	}, nil
 }
 
-func rawJSONString(raw json.RawMessage) (string, bool) {
+func rawJSONString(raw json.RawMessage) string {
 	if !isPresentJSON(raw) {
-		return "", false
+		return ""
 	}
 	var value string
 	if err := json.Unmarshal(raw, &value); err != nil {
-		return "", false
+		return ""
 	}
-	return value, true
+	return value
 }
 
 func putJSON(route map[string]json.RawMessage, key string, value any) error {
@@ -245,5 +246,5 @@ func putJSON(route map[string]json.RawMessage, key string, value any) error {
 }
 
 func errorsIsNotFound(err error) bool {
-	return err != nil && (err == gorm.ErrRecordNotFound || strings.Contains(strings.ToLower(err.Error()), "record not found"))
+	return err != nil && (errors.Is(err, gorm.ErrRecordNotFound) || strings.Contains(strings.ToLower(err.Error()), "record not found"))
 }

internal/apps/openflare/pages/source_orphan_cleanup.go

@@ -111,6 +111,8 @@ func (summary *PagesOrphanCleanupSummary) add(outcome pagesOrphanCleanupOutcome)
 		summary.LeaseBusy++
 	case pagesOrphanCleanupInvalidMarker:
 		summary.InvalidMarker++
+	case pagesOrphanCleanupSkipped:
+		summary.Skipped++
 	default:
 		summary.Skipped++
 	}

internal/apps/openflare/pages/source_scanner.go

@@ -266,6 +266,8 @@ func scanOneDueGitHubSource(
 	case sourceLeaseStale:
 		summary.StaleSources++
 		return
+	case sourceLeaseAcquired:
+		// 获取执行权成功，继续执行扫描。
 	}
 	if snapshot == nil || snapshot.SourceType != PagesSourceTypeGitHubRelease ||
 		snapshot.ReleaseSelector != githubReleaseSelectorLatest {

internal/apps/openflare/pages/source_sync.go

@@ -9,7 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"path"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -611,7 +611,7 @@ func lockSourceDeploymentUploadsTx(
 	if hasIngest && ingestResult.Upload.ID != 0 && ingestResult.Upload.ID != target.UploadID {
 		uploadIDs = append(uploadIDs, ingestResult.Upload.ID)
 	}
-	sort.Slice(uploadIDs, func(i, j int) bool { return uploadIDs[i] < uploadIDs[j] })
+	slices.Sort(uploadIDs)
 	var records []model.Upload
 	if err := tx.Clauses(clause.Locking{Strength: pagesRowLockStrength}).
 		Where("id IN ?", uploadIDs).

internal/apps/openflare/pages/source_tasks.go

@@ -154,10 +154,8 @@ func (h *SourceActionHandler) Execute(ctx context.Context, payload []byte) (*tas
 	if source.SourceType != PagesSourceTypeRemoteURL && source.SourceType != PagesSourceTypeGitHubRelease {
 		return nil, task.PermanentError(errPagesSourceTypeUnsupported)
 	}
-	if source.SourceType == PagesSourceTypeRemoteURL && (input.TargetRevision != "" || input.ConfirmedRevision != "") {
-		return nil, task.PermanentError(errPagesSourceActionInvalid)
-	}
-	if input.Action == sourceActionCheck && (input.TargetRevision != "" || input.ConfirmedRevision != "") {
+	if (source.SourceType == PagesSourceTypeRemoteURL || input.Action == sourceActionCheck) &&
+		(input.TargetRevision != "" || input.ConfirmedRevision != "") {
 		return nil, task.PermanentError(errPagesSourceActionInvalid)
 	}
 
@@ -174,6 +172,8 @@ func (h *SourceActionHandler) Execute(ctx context.Context, payload []byte) (*tas
 	case sourceLeaseStale:
 		task.AppendLog(ctx, "[resolve] 来源配置或执行权已变化，本次任务跳过")
 		return &task.TaskResult{Message: errPagesSourceActionStale}, nil
+	case sourceLeaseAcquired:
+		// 已获取执行权，继续执行。
 	}
 
 	if input.Action == sourceActionCheck {